4 ms·

Similar discussion 9 days ago on the thread Apple urged to drop plans to scan iMessages, images for sex abuse: https://news.ycombinator.com/item?id=28233200 ht

Similar discussion 9 days ago on the thread Apple urged to drop plans to scan iMessages, images for sex abuse: https://news.ycombinator.com/item?id=28233200 https://news.ycombinator.com/item?id=28233200 Perhaps we need a new term, other than E2E encrypted, to close the door on 'loopholes' such as the provider managing your keys.

INTPenis 5y ago
No, let's just use common sense. You can't trust anything to be e2ee if it's not open source too. In this case Apple can do anything they want with the keys since it's a locked down and closed platform.
- yawaworht1978 5y ago
  This is the only real sensible approach. Even with open source signal, people say they still might be able to see things. Is there no way to test this?
- Sebb767 5y ago
  > You can't trust anything to be e2ee if it's not open source too. You can't trust anything unless you built it yourself [0]. Just because I tell you that binary is built from the source code does not mean it's not backdoored. [0] Theoretically, reproducible builds provide the same security, but in the end you need to build it yourself to get the hash, at which point you just replace one `cp` with two `sha256sum`.
  - api 5y ago
    Nope. Not there yet. You also have to audit the source and make sure someone hasn’t slipped in a back door or intentionally introduced bug.
    - ummonk 5y ago
      And of course have to audit the hardware design, and then audit the manufacturing and supply chain for that hardware to ensure someone hasn't substituted hardware with spyware installed.
  - heavyset_go 5y ago
    With open systems and code, you can verify if code is doing the things you expect it to, and if you're paranoid enough, you can choose to build everything from the ground up. If there are enough security conscious people out there for there to be a market for security-focused systems, then companies can come in and offer verified systems and reproducible builds of things those people care about. With closed systems, the best you can hope for is to treat it like a black box that can and will change out from under you.
    - judge2020 5y ago
      having a 3p come in and perform a build doesn't ensure there's not an attack targeted at you, though. You have no idea if yours is different unless you add PKI & CT logging to the mix (which wouldn't be horrible).
      - heavyset_go 5y ago
        My point is that with open systems, you have vastly more options depending on how paranoid you are and who your adversary is compared to closed systems.
    - threeseed 5y ago
      We can play this game all day. 99.999% of open source projects rely on Github Actions, Circle CI, Travis CI etc to build their code. Those are all proprietary so unless you are running your own CI/CD stack then you can't trust the code. And of course every open source project relies on libraries. So you need to make sure this applies equally to them as well.
      - heavyset_go 5y ago
        Yes, I'm pretty sure we're all familiar with "Reflections on Trusting Trust"[1]. Security comes in layers, and with open systems, if you want to, and if you have the resources, you can audit and verify those layers depending on your level of paranoia and your potential adversaries. You might throw your hands up in the air because security isn't assured and go all in on closed, black box systems, but there is value in open systems when it comes to security. [1] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
  - deleted 5y ago
    [deleted]
  - dmurray 5y ago
    Trusting a million eyes is acceptable for most people's threat models. I trust (Apple AND a community of people who can tell me the hash of the build) much more than I trust Apple alone. It's like if you're trying to figure out how a magician does a trick, "he must have a collaborator in the audience" is a reasonable guess. "Everyone in the audience other than me is a collaborator" is usually not.
  - JadeNB 5y ago
    > You can't trust anything unless you built it yourself [0]. As "Reflections on trusting trust" (https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...) points out, you can't trust anything including if you built it yourself, at least assuming you mean 'build' in the software sense. Even in the hardware sense, it's probably beyond the reach of anyone, let alone any individual actor, to build a modern computing machine from bare metal in a way that involves no trust of a third party.
rhn_mk1 5y ago
Loopholes already make E2EE impossible. The "end" of encryption is not the entry point of your device, it's you: the user (more specifically, as close as possible the place where the data is displayed/entered). If there is some additional stage before/after encryption, then it's not end-to-end.
- zepto 5y ago
  There is always some additional stage after the encryption. It’s silly not to call it E2E, since e2e just means that no eavesdropper in the middle can intercept it. If you don’t trust the person who wrote the software you are using, that is a different issue. Just as serious, but it has nothing to do with either it is E2E or not.
  - rhn_mk1 5y ago
    If you allow untrusted or undersired stages between the "end" and the user, how do you define "end-to-end" without allowing unencrypted intercontinental links?
    - zepto 5y ago
      That’s self evident. The encryption is between the ends. Allowing unencrypted intercontinental links is a total non-sequitur. You know where the ends are. As I said, you always have something between you and the ‘end’, and you always have to trust someone. Whether something is E2E or not is completely independent from whether you trust your software.
thenickdude 5y ago
E2E with key escrow describes this situation
mackrevinack 5y ago
AE2EE - almost end to end encrypted

INTPenis 5y ago

No, let's just use common sense. You can't trust anything to be e2ee if it's not open source too. In this case Apple can do anything they want with the keys since it's a locked down and closed platform.

yawaworht1978 5y ago
This is the only real sensible approach. Even with open source signal, people say they still might be able to see things. Is there no way to test this?
Sebb767 5y ago
> You can't trust anything to be e2ee if it's not open source too. You can't trust anything unless you built it yourself [0]. Just because I tell you that binary is built from the source code does not mean it's not backdoored. [0] Theoretically, reproducible builds provide the same security, but in the end you need to build it yourself to get the hash, at which point you just replace one `cp` with two `sha256sum`.
- api 5y ago
  Nope. Not there yet. You also have to audit the source and make sure someone hasn’t slipped in a back door or intentionally introduced bug.
  - ummonk 5y ago
    And of course have to audit the hardware design, and then audit the manufacturing and supply chain for that hardware to ensure someone hasn't substituted hardware with spyware installed.
- heavyset_go 5y ago
  With open systems and code, you can verify if code is doing the things you expect it to, and if you're paranoid enough, you can choose to build everything from the ground up. If there are enough security conscious people out there for there to be a market for security-focused systems, then companies can come in and offer verified systems and reproducible builds of things those people care about. With closed systems, the best you can hope for is to treat it like a black box that can and will change out from under you.
  - judge2020 5y ago
    having a 3p come in and perform a build doesn't ensure there's not an attack targeted at you, though. You have no idea if yours is different unless you add PKI & CT logging to the mix (which wouldn't be horrible).
    - heavyset_go 5y ago
      My point is that with open systems, you have vastly more options depending on how paranoid you are and who your adversary is compared to closed systems.
  - threeseed 5y ago
    We can play this game all day. 99.999% of open source projects rely on Github Actions, Circle CI, Travis CI etc to build their code. Those are all proprietary so unless you are running your own CI/CD stack then you can't trust the code. And of course every open source project relies on libraries. So you need to make sure this applies equally to them as well.
    - heavyset_go 5y ago
      Yes, I'm pretty sure we're all familiar with "Reflections on Trusting Trust"[1]. Security comes in layers, and with open systems, if you want to, and if you have the resources, you can audit and verify those layers depending on your level of paranoia and your potential adversaries. You might throw your hands up in the air because security isn't assured and go all in on closed, black box systems, but there is value in open systems when it comes to security. [1] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
- deleted 5y ago
  [deleted]
- dmurray 5y ago
  Trusting a million eyes is acceptable for most people's threat models. I trust (Apple AND a community of people who can tell me the hash of the build) much more than I trust Apple alone. It's like if you're trying to figure out how a magician does a trick, "he must have a collaborator in the audience" is a reasonable guess. "Everyone in the audience other than me is a collaborator" is usually not.
- JadeNB 5y ago
  > You can't trust anything unless you built it yourself [0]. As "Reflections on trusting trust" (https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...) points out, you can't trust anything including if you built it yourself, at least assuming you mean 'build' in the software sense. Even in the hardware sense, it's probably beyond the reach of anyone, let alone any individual actor, to build a modern computing machine from bare metal in a way that involves no trust of a third party.

rhn_mk1 5y ago

Loopholes already make E2EE impossible. The "end" of encryption is not the entry point of your device, it's you: the user (more specifically, as close as possible the place where the data is displayed/entered). If there is some additional stage before/after encryption, then it's not end-to-end.

zepto 5y ago
There is always some additional stage after the encryption. It’s silly not to call it E2E, since e2e just means that no eavesdropper in the middle can intercept it. If you don’t trust the person who wrote the software you are using, that is a different issue. Just as serious, but it has nothing to do with either it is E2E or not.
- rhn_mk1 5y ago
  If you allow untrusted or undersired stages between the "end" and the user, how do you define "end-to-end" without allowing unencrypted intercontinental links?
  - zepto 5y ago
    That’s self evident. The encryption is between the ends. Allowing unencrypted intercontinental links is a total non-sequitur. You know where the ends are. As I said, you always have something between you and the ‘end’, and you always have to trust someone. Whether something is E2E or not is completely independent from whether you trust your software.

thenickdude 5y ago

E2E with key escrow describes this situation

mackrevinack 5y ago

AE2EE - almost end to end encrypted